Deanonymisation Is Not Theory
Practical obscurity protected pseudonyms because linking them was expensive. LLMs collapsed that cost — and most threat models have not caught up.
Online deanonymisation is no longer a theoretical edge case reserved for spies and journalists. Large language models made linking pseudonymous posts to real identities cheap enough that “anonymous enough” is a weak programme assumption.
For most of the public web, privacy for ordinary handles rested on friction, not cryptography. A determined investigator could often stitch a city, a job title, a niche hobby, and a writing habit into a name. What kept that threat tolerable was cost: hours of skilled work per target, usually spent only when the incentive was high.
That bargain had a name in security conversation — practical obscurity. The theory was never that re-identification was impossible. The theory was that it would not scale.
What changed when LLMs entered the threat model?
In February 2026, Simon Lermen, Daniel Paleka, Joshua Swanson, Michael Aerni, Nicholas Carlini, and Florian Tramèr published Large-scale online deanonymization with LLMs. The paper does not invent a new kind of clue. It shows that models can extract identity-relevant signals from unstructured prose, search large candidate pools, and reason about whether two accounts belong to the same person — without the old requirement for tidy feature schemas and heavy manual verification.
The reported lift is not incremental. Under their evaluation settings, LLM-based methods reached up to about 68% recall at 90% precision, while classical non-LLM baselines often fell near zero on the same tasks. Press coverage in Ars Technica and The Register framed the same point: the economics moved, not the existence of side-channels.
The researchers also showed agentic setups with web access matching Hacker News profiles toward LinkedIn identities, and re-identifying participants from partially redacted Anthropic Interviewer material. Reported costs sit in the rough band of a few dollars per successful identification in those experiments — cheap enough that “we would never spend that” stops being a control.
This article stays at that level on purpose. The useful programme question is not how to reproduce a pipeline. It is whether your current privacy story still assumes that correlation work is rare and expensive.
Why does this matter on a delivery programme?
Delivery teams meet pseudonymity in boring places.
- Support and community forums — staff and customers post under handles that quietly accumulate employer, stack, timezone, and incident detail.
- Research and discovery notes — workshop quotes, interview excerpts, and “anonymised” case studies that still name a rare stack, a city, and a release date.
- Paste culture into AI tools — client context, ticket text, and Slack residue enter models that were never part of the original anonymity bargain. The team agreement problem is related; the identity problem is adjacent.
- Insider and social-engineering risk — a handle that was “good enough” for a public rant becomes a targeting surface once it links to a CV, GitHub, or conference talk.
None of those require a novel exploit. They require the same micro-data people already publish because that is what makes communities useful. The paper’s uncomfortable conclusion is that the data that makes participation worthwhile is also the data that makes linking workable.
What should teams assume now?
Update the threat model before you update the tool list.
- Assume linkability for persistent handles. If a skilled human could join your posts to a real identity in an afternoon, treat an LLM-assisted adversary as able to attempt the same class of work at lower cost.
- Treat light redaction as incomplete. Removing a name while leaving a rare role, product, and timeline is not anonymisation. It is delayed identification.
- Separate “no direct identifier” from “not identifying.” Natural-language residue about a person is often enough. Privacy reviews that only hunt for email addresses and account numbers will miss the new failure mode.
- Put ownership on paste and publish decisions. Name who decides when forum text, interview notes, or client context may leave the controlled channel — silence is not a control.
- Do not wait for perfect vendor guardrails. The research notes that the work decomposes into summarisation, search, and ranking tasks that look individually benign. Hope is not a compensating control.
None of this means every account will be unmasked tomorrow. Precision and recall are not 100%. Pool size still matters. Open questions remain about defence at platform and model-provider layers. The claim is narrower and harder: practical obscurity is no longer a safe default for ordinary pseudonymous activity.
Deanonymisation was always possible in theory. The 2026 result is that it is now practical enough to redesign around — not as a thriller plot, but as a programme assumption.
If a careful colleague could name you from your public posts alone, your threat model should already treat that link as automatable.
Frequently asked questions
Is online deanonymisation still only theoretical?
No. For most of the web era, re-identification was possible in principle but expensive in practice. Large language models have collapsed that cost, so practical obscurity no longer protects ordinary pseudonymous accounts.
What did the 2026 LLM deanonymisation research show?
Lermen, Paleka, Swanson, Aerni, Carlini, and Tramèr showed LLM pipelines can match unstructured text profiles across platforms at up to about 68% recall at 90% precision, far above classical baselines that often fell near zero under the same conditions.
What should delivery teams assume about pseudonymous accounts?
Treat persistent handles, forum histories, and lightly redacted interview text as linkable identity signals. Do not design programme privacy on the hope that correlation stays too hard for a moderately resourced adversary.